ci/gha: add fedora job

Some recently added features require openat2 support to be tested.
We used Travis for that, but it's not available now, so let's use
a GHA VM.

Code mostly copied from github.com/opencontainers/runc.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

.ci/Vagrantfile.fedora32 → .ci/Vagrantfile.fedora33

@@ -3,7 +3,7 @@
 
 Vagrant.configure("2") do |config|
 # Fedora box is used for testing cgroup v2 support
-  config.vm.box = "fedora/32-cloud-base"
+  config.vm.box = "fedora/33-cloud-base"
   config.vm.provider :virtualbox do |v|
     v.memory = 2048
     v.cpus = 2
@@ -20,8 +20,7 @@ Vagrant.configure("2") do |config|
       cat << EOF | dnf -y shell && break
 config exclude kernel,kernel-core
 config install_weak_deps false
-update
-install make golang-go libseccomp-devel git-core
+install make golang-go git-core
 ts run
 EOF
     done

.github/workflows/test.yml

@@ -28,3 +28,22 @@ jobs:
         sudo -E PATH=$PATH make test
         # fixup go cache screwed by sudo
         sudo chown -R runner:$HOME/.cache
+
+  # some features, like openat2, require a newer kernel
+  fedora:
+    # nested virtualization is only available on macOS hosts
+    runs-on: macos-10.15
+    steps:
+      - uses: actions/checkout@v2
+      - name: prepare vagrant
+        run: |
+          ln -sf .ci/Vagrantfile.fedora33 Vagrantfile
+          # Retry if it fails (download.fedoraproject.org returns 404 sometimes)
+          vagrant up || vagrant up
+          vagrant ssh-config >> ~/.ssh/config
+
+      - name: system info
+        run: ssh default 'sh -exc "uname -a && df -T"'
+
+      - name: tests
+        run: ssh default 'cd /vagrant && sudo make test'